{"id":6404,"date":"2017-01-27T04:30:53","date_gmt":"2017-01-27T12:30:53","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/27\/news-241\/"},"modified":"2017-01-27T04:30:53","modified_gmt":"2017-01-27T12:30:53","slug":"news-241","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/27\/news-241\/","title":{"rendered":"Right answer, wrong question"},"content":{"rendered":"

This credit union updates its online banking website, so a pilot fish with accounts there updates all her family’s accounts.<\/p>\n

“The new feature was security questions,” says fish. “I didn’t like the three that were given, so I did the drop-down to see more questions. I chose my three new questions and wrote down the answers so the spouse knew what they were.”<\/p>\n

But the first time he tries it, he blows the password. Fish has to go through the whole process of recreating the account setup.<\/p>\n

Next time he tries, fish has to go through the entire process again<\/i> — but this time she prints out screen captures of the questions she chose, and writes the answers on them.<\/p>\n

To make sure it doesn’t happen a third time, fish walks him through the process of logging in. But when they get to the security question, the one that pops up is not<\/i> one of the new questions fish has selected.<\/p>\n

“I purposely chose questions I knew he could answer,” fish says. “I bypassed the question about what high school I had graduated from, but there it was, waiting for an answer.<\/p>\n

“On my last try of the three-tries-or-you’re-locked-out scenario, I remembered that was the first question of their three original choices. So I supplied the answer I had used for the first question, ‘Where were you born?’ Bingo, I was in.”<\/p>\n

This is ridiculous, fish thinks. She puts in a call to the same customer service rep who has already reset the account’s password twice. The rep tells fish that a whole lot of people are getting locked up on the security questions.<\/p>\n

Can I talk to the programmer? fish asks. I can’t transfer you, rep says.<\/p>\n

OK, write this down and give it to the IT department, fish says. Tell them that while they let users pick new questions, they’re recording the answers but keeping the original default questions as first presented.<\/p>\n

“I also asked where to send my bill for problem-solving consulting, but never heard back from them,” says fish.<\/p>\n

“But now we have a way of making the security questions unanswerable by hackers. For example, for the question ‘Where were you born?’ we key in the year of the account holder’s birth as the answer.”<\/p>\n

Answer Sharky’s call for true tales of IT life!<\/strong> Send me your stories at sharky@computerworld.com<\/a>. You’ll snag a snazzy Shark shirt every time I use one. Comment on today’s tale at Sharky’s Google+ community<\/strong><\/a>, and read thousands of great old tales in the Sharkives<\/strong><\/a>.<\/i><\/p>\n

Get your daily dose of out-takes from the IT Theater of the Absurd delivered directly to your Inbox. Subscribe now to the Daily Shark Newsletter<\/a>.<\/em><\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\n
\n

This credit union updates its online banking website, so a pilot fish with accounts there updates all her family’s accounts.<\/p>\n

“The new feature was security questions,” says fish. “I didn’t like the three that were given, so I did the drop-down to see more questions. I chose my three new questions and wrote down the answers so the spouse knew what they were.”<\/p>\n

But the first time he tries it, he blows the password. Fish has to go through the whole process of recreating the account setup.<\/p>\n

Next time he tries, fish has to go through the entire process again<\/i> — but this time she prints out screen captures of the questions she chose, and writes the answers on them.<\/p>\n

To read this article in full or to leave a comment, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[714],"class_list":["post-6404","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=6404"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6404\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=6404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=6404"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=6404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}